CVE-2025-54458

CWE-862 — Missing AuthorizationCWE-416 — Use After Free6 documents5 sources
Severity
5.0MEDIUM
EPSS
0.0%
top 87.93%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Mattermost Mattermost Confluence PluginGithub.com Mattermost/mattermost-plugin-confluenceMattermost Confluence
Timeline
PublishedAug 11
Latest updateAug 18

Description

Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the Confluence space which allows attackers to create a subscription for a Confluence space the user does not have access to via the create subscription endpoint.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:NExploitability: 3.1 | Impact: 1.4

Affected Packages3 packages

🔴Vulnerability Details

4
OSV
Mattermost Confluence Plugin has Missing Authorization vulnerability in github.com/mattermost/mattermost-plugin-confluence↗2025-08-18
▶
GHSA
Mattermost Confluence Plugin has Missing Authorization vulnerability↗2025-08-11
▶
OSV
Mattermost Confluence Plugin has Missing Authorization vulnerability↗2025-08-11
▶
CVEList
Unauthorized Subscription Creation to Confluence Space in Mattermost Confluence Plugin↗2025-08-11
▶

📋Vendor Advisories

1
Microsoft
scsi: ufs: bsg: Set bsg_queue to NULL after removal↗2025-02-11
▶
CVE-2025-54458 (MEDIUM CVSS 5) | Mattermost Confluence Plugin versio | cvebase.io